I'm not from Cloudflare, or particularly a fan of theirs, but they are doing a few things about this, including a new WAF capability: https://blog.cloudflare.com/full-transaction-waf/ and automatic protection for all customers https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...

These were rolled out before the exploit became public.

I would wouldn't describe that as damning.

It's great they are doing mitigations, but they admit themselves, in fine print, that this will not protect you from the vulnerability

Why is word circulating that you can just sign up for Cloudflare and be 100% protected from this? They are burying the leed and trying to get new customers, and it's working.